Orcle 12c 新特性 --- 增强PDB Lockdown Profiles

jiawang

说明
1.1 关于PDB Lockdown Profiles
PDB lockdown profile是一组可以控制操作的命名集。控制PDB的操作权限，是对所有用户都生效。
例如：可以控制用户禁止直行ALTER SYSTEM这样的语法。某种程度上保证了数据库的安全性。

可以限制下面四个方面的操作：

    Network access features. These are operations that use the network to communicate outside the PDB. For example, the PL/SQL packages UTL_TCP, UTL_HTTP, UTL_MAIL, UTL_SNMP, UTL_INADDR, and DBMS_DEBUG_JDWP perform these kinds of operations. Currently, ACLs are used to control this kind of access to share network identity.

    Common user or object access. These are operations in which a local user in the PDB can proxy through common user accounts or access objects in a common schema. These kinds of operations include adding or replacing objects in a common schema, granting privileges to common objects, accessing common directory objects, granting the INHERIT PRIVILEGES role to a common user, and manipulating a user proxy to a common user.

    Operating System access. For example, you can restrict access to the UTL_FILE or DBMS_FILE_TRANSFER PL/SQL packages.

    Connections. For example, you can restrict common users from connecting to the PDB or you can restrict a local user who has the SYSOPER administrative privilege from connecting to a PDB that is open in restricted mode.

实验
2.1 创建PDB Lockdown Profile

–登录到CDB root，然后创建Lockdown profile

SQL> create lockdown profile cndba_prof;
Lockdown Profile created.

–修改Lockdown profile，禁用刷新共享池

SQL> ALTER LOCKDOWN PROFILE cndba_prof DISABLE STATEMENT = ('ALTER SYSTEM') clause = ('flush shared_pool');
Lockdown Profile altered.

    注意：一个Lockdown profile正在使用，如果修改它，会立刻生效。

2.2 启用PDB Lockdown Profile    CDB级别启用Lockdown Profile，那么就会对该CDB下的所有PDB都生效

SQL> alter system set pdb_lockdown=cndba_prof;
System altered.


    PDB级别启用Lockdown Profile，则只对这个PDB生效

alter system set pdb_lockdown=cndba_prof;

  
2.3 登录到PDB测试是否有效

根据Lockdown profile所有限制的操作，做清空共享池操作。

SQL> alter system flush shared_pool;
alter system flush shared_pool
*
ERROR at line 1:
ORA-01031: insufficient privileges

提示没有权限操作，其他操作正常。如：

SQL>  alter system set sessions=400;
System altered.


2.4 禁用PDB Lockdown Profile

同样区分CDB级别和PDB级别设置
alter system set pdb_lockdown='';


2.5 删除PDB Lockdown Profile

SQL > DROP Lockdown Profile cndba_prof;
Lockdown Profile dropped.